CVE-2022-38196mediumCWE-22

CVE-2022-38196: medium-severity vulnerability in Esri ArcGIS Server

BUG-000150537 - ArcGIS Server has a local file inclusion (LFI) vulnerability

Published · Updated

Follow this CVE+ Monitor ArcGIS Server

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 6.5epss 1.2%
In short

ArcGIS Server allows authenticated users to traverse directories and overwrite internal files, potentially disrupting the service. This happens because the application doesn't properly validate file paths provided by users.

Technical detail

A path traversal vulnerability in ArcGIS Server versions 10.9.1 and prior permits authenticated attackers to manipulate file paths using directory traversal sequences, enabling arbitrary file overwrite within ArcGIS Server directories. The vulnerability requires prior authentication and results in denial of service through corruption of critical internal files.

Summary generated and translated by AI from the official description.
Esri ArcGIS Server versions 10.9.1 and prior have a path traversal vulnerability that may result in a denial of service by allowing a remote, authenticated attacker to overwrite internal ArcGIS Server directory.
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H
Affected products
Esri · ArcGIS Server
Related CVEs — Esri ArcGIS Server

In the same product, most dangerous first.

CVE-2021-29115MEDIUMAn information disclosure vulnerabilityEPSS 2.2%CVE-2021-29102CRITICALThere is a Server-Side Request Forgery (SSRF) vulnerability in Esri ArcGIS Server Manager version 10.8.1 and below.EPSS 1.6%CVE-2022-38202HIGHBUG-000152121 - Directory traversal vulnerability in ArcGIS Server.EPSS 1.4%CVE-2026-9181CRITICALDirectory Traversal in ArcGIS ServerEPSS 1.2%CVE-2021-29114HIGHSQL injection vulnerability in ArcGIS ServerEPSS 1.0%CVE-2021-29094MEDIUMArcGIS Server image service and raster analytics security update: buffer overflowEPSS 1.0%